Tüm alıştırma soruları

Soru 341Soru →

An organization is evaluating its security architecture following a comprehensive risk assessment. Match each enterprise security measure to its correct dual-axis classification (Category and Functional Type) according to CompTIA Security+ standards.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

1. Annual awareness training maps to Managerial Category / Directive Type. 2. Automated host isolation script maps to Technical Category / Corrective Type. 3. Biometric mantrap system maps to Physical Category / Preventive Type. 4. Segmented jump server fallback maps to Technical Category / Compensating Type.

Each security control is accurately categorized by implementation method (Managerial, Technical, Physical) and functional purpose (Directive, Corrective, Preventive, Compensating). Policy sign-offs direct behavior (Managerial/Directive); host isolation mitigates ongoing attack damage (Technical/Corrective); physical mantraps prevent unauthorized entry (Physical/Preventive); and jump boxes act as substitute technical measures for legacy systems (Technical/Compensating).

Adım Adım Çözüm

1

Analyze the primary category (Managerial, Operational, Technical, Physical) for each mechanism based on its underlying operational domain.

Training/policy is Managerial; automated endpoint script is Technical; mantrap facility hardware is Physical; jump server infrastructure is Technical.

Control categories are determined by how the control is implemented—via policy/governance, physical assets, human operations, or system logic.

2

Determine the functional goal (Preventive, Deterrent, Detective, Corrective, Compensating, Directive) for each mechanism.

Training directs compliance (Directive); isolation remediates active threat impact (Corrective); mantraps block unauthorized access (Preventive); jump server replaces missing native controls (Compensating).

Functional types define the operational intent relative to security incidents (before, during, after, or in place of primary controls).

3

Pair each implementation with its corresponding dual-axis category and functional type classification.

All four pairings are established cleanly based on CompTIA Security+ SY0-701 standard taxonomy definitions.

Correct mapping requires aligning both the category axis and functional type axis simultaneously.

Anahtar Kavram

Security Control Categories and Functional Types

Soru 342Soru →

An organization is modernizing its security controls by adopting Zero Trust Architecture (ZTA) principles across its enterprise environment. Match each core Zero Trust principle on the left with its corresponding operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Implicit Trust Elimination pairs with treating all network locations as untrusted; Microsegmentation pairs with isolating network workloads into granular enclaves; Continuous Verification pairs with dynamically re-evaluating context throughout an active session; Least Privilege Access pairs with granting permissions strictly on a per-resource and per-request basis.

Each Zero Trust principle correctly aligns with its operational definition: Implicit Trust Elimination treats all network environments as untrusted; Microsegmentation isolates workloads into granular enclaves; Continuous Verification continuously evaluates risk across the session lifetime; Least Privilege Access restricts privileges strictly to required resources per transaction.

Adım Adım Çözüm

1

Evaluate 'Implicit Trust Elimination'

Matches treating all network zones as untrusted boundaries requiring explicit validation.

Zero Trust discards the concept of a trusted internal network segment.

2

Evaluate 'Microsegmentation'

Matches isolating workloads into granular enclaves to prevent lateral movement.

Partitioning resources creates strict micro-perimeters around individual applications or assets.

3

Evaluate 'Continuous Verification'

Matches dynamically re-evaluating identity and risk throughout an active connection.

Zero Trust requires real-time monitoring of user and device state beyond initial authentication.

4

Evaluate 'Least Privilege Access'

Matches granting rights strictly on a per-resource and per-request basis.

Access is scoped strictly to what is necessary for the specific requested operation.

Anahtar Kavram

Zero Trust Architecture Core Tenets

Tahmini Süre:1m 30s

Soru 343Soru →

A security analyst is selecting scanning techniques for various operational scenarios across an enterprise network. Match each vulnerability assessment technique to its corresponding characteristic or primary use case.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Credentialed Vulnerability Scan matches with inspecting local OS patch levels and host configurations accurately with low false positives. Non-Credentialed Vulnerability Scan matches with identifying exposed services from an unauthenticated attacker's perspective. Passive Vulnerability Assessment matches with monitoring traffic via SPAN/mirror ports without sending probes. Intrusive Vulnerability Scan matches with simulating exploitation scripts with risk of system instability.

Each scanning technique is paired with its defining operational mechanism: credentialed scans use host logins to inspect software registries with high precision; non-credentialed scans simulate external network reconnaissance; passive scanning observes existing traffic via port mirrors; and intrusive scanning runs active verification checks that carry potential instability risks.

Adım Adım Çözüm

1

Analyze internal host configuration scanning needs

Identified Credentialed Vulnerability Scan as requiring local system access to inspect patch levels and registry entries directly.

Authenticating to target systems provides precise inventory and patch data with low false-positive rates.

2

Evaluate external threat posture assessment requirements

Identified Non-Credentialed Vulnerability Scan as probing network ports externally without authenticating.

Simulates an outside adversary analyzing public banner responses and exposed network listeners.

3

Examine operational constraints for sensitive or legacy infrastructure

Identified Passive Vulnerability Assessment as monitoring existing network traffic non-disruptively.

Listening to network traffic avoiding target interaction prevents service interruptions on sensitive systems.

4

Distinguish between vulnerability discovery and active verification risk

Identified Intrusive Vulnerability Scan as executing active checks that verify vulnerabilities by attempting benign exploitation.

Active verification confirms vulnerability impact but poses risk of service crashes.

Anahtar Kavram

Selecting appropriate vulnerability scanning methodologies based on authentication, network impact, and operational risk boundaries.

Soru 344Soru →

A senior security architect is updating an enterprise security standard to enforce modern cryptographic controls across cloud, archive, hardware, and transport systems. Match each operational cryptographic requirement on the left to the corresponding technical concept or mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Homomorphic encryption pairs with performing calculations on encrypted data; Post-quantum cryptography pairs with defending against future quantum decryption of archived data; HSM key wrapping pairs with encapsulating Data Encryption Keys for transfer using a hardware root of trust; Steganography pairs with concealing commands inside the least significant bits of image files.

Each requirement strictly maps to its specialized cryptographic control: Homomorphic encryption allows cloud compute on encrypted data without decryption; Post-quantum cryptography mitigates future quantum decryption risks against intercepted archives; HSM key wrapping protects keys in transit by encrypting DEKs with KEKs managed by hardware; Steganography hides payload content within image files.

Adım Adım Çözüm

1

Analyze the requirement for processing encrypted cloud data without decryption.

Identify that Homomorphic Encryption enables mathematical operations directly on ciphertext while preserving privacy from the host.

Traditional symmetric and asymmetric ciphers require plaintext exposure in memory to perform arithmetic operations.

2

Analyze the threat vector of adversaries capturing encrypted archives today to decrypt them when quantum computing matures.

Identify Post-quantum cryptography (quantum-resistant algorithms) as the control designed to withstand quantum cryptanalytic attacks like Shor's algorithm.

Standard RSA and ECC asymmetric algorithms are vulnerable to quantum factoring, requiring new mathematical primitives.

3

Examine the process of exporting symmetric encryption keys safely using dedicated crypto hardware.

Match HSM key wrapping as the practice of encrypting session keys or DEKs with a master Key Encryption Key residing within an HSM enclave.

Plaintext key transport exposes secrets in memory; key wrapping guarantees keys remain encrypted during transit across boundaries.

4

Evaluate the technique of hiding data inside image files using least significant bit alteration.

Match this obfuscation method to Steganography.

Steganography focuses on hiding the existence of a message rather than rendering message contents unreadable.

Anahtar Kavram

Cryptographic Primitives and Advanced Operational Controls

Soru 345Soru →

A security administrator is reviewing identity management definitions for new security operations team members. Match each access control phase of the AAA framework on the left with its corresponding operational security scenario on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Identification matches entering a unique username to claim identity; Authentication matches validating a password and TOTP code to prove identity; Authorization matches evaluating security policies to grant network subnet access; Accounting matches collecting log entries detailing session times and bandwidth usage.

Each phase of the access control model serves a distinct security role: Identification claims identity via an identifier (username); Authentication verifies that claim using credentials (password + TOTP); Authorization enforces access permissions (firewall rules); and Accounting logs resource usage and activity (SIEM/RADIUS session logs).

Adım Adım Çözüm

1

Distinguish between Identification and Authentication

Entering a username simply claims identity (Identification), while verifying credentials like passwords and TOTP codes proves that identity (Authentication).

Identification must precede authentication in the identity lifecycle.

2

Define Authorization controls

Evaluating firewall security policies to permit or restrict access to specific network resources aligns directly with enforcing access permissions (Authorization).

Authorization dictates what an authenticated entity is permitted to do.

3

Identify Accounting functions

Collecting session start/stop times, command histories, and bandwidth logs on a SIEM or RADIUS server fulfills auditing and tracking requirements (Accounting).

Accounting creates non-repudiable audit logs of user activity.

Anahtar Kavram

Authentication, Authorization, and Accounting (AAA) Framework

Soru 346Soru →

Match each social engineering principle of influence on the left with its corresponding enterprise attack scenario description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Authority matches the executive impersonation scenario; Consensus matches the claim that all other department heads submitted credentials; Scarcity matches the claim of limited remaining license slots; Urgency matches the claim of an imminent server crash within minutes.

Each principle of influence aligns with its specific psychological trigger: Authority uses hierarchy and position, Consensus relies on peer participation, Scarcity uses perceived limited availability, and Urgency creates artificial time pressure.

Adım Adım Çözüm

1

Analyze each scenario on the right to identify the psychological driver leveraged by the attacker.

The executive role exploits power (Authority); peer actions exploit social proof (Consensus); limited licenses exploit limited supply (Scarcity); short deadlines exploit time pressure (Urgency).

Social engineering attacks rely on specific psychological principles of influence to manipulate victims.

2

Pair each principle of influence on the left to its corresponding attack scenario.

Authority maps to executive demand, Consensus maps to peer compliance, Scarcity maps to limited slots, and Urgency maps to the tight time constraint.

Matching principles to their defining characteristics confirms correct identification of attack vectors.

Anahtar Kavram

Principles of Influence in Social Engineering

Tahmini Süre:1m 0s

Soru 347Soru →

An organization is restructuring its information security governance framework following a major compliance assessment. The Chief Information Security Officer (CISO) needs to categorize four key documentation elements within the administrative governance hierarchy based on their operational enforcement level and organizational scope. Match each security governance document type on the left with its corresponding operational attribute on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Acceptable Use Policy matches the high-level mandatory executive directive; Data Encryption Standard matches the mandatory technical requirement specifying cryptographic suites; Container Hardening Baseline matches the minimum required configuration state for container images; Remote Work Security Guideline matches the discretionary recommendations and best practices.

In security governance, documents follow a clear administrative structure: Policies provide high-level mandatory management intent; Standards set compulsory technical requirements; Baselines define minimum mandatory operational configurations; and Guidelines provide non-mandatory, advisory recommendations.

Adım Adım Çözüm

1

Analyze the organizational governance hierarchy level for each document.

Identify high-level policy vs technical standards vs operational baselines vs discretionary guidelines.

Security governance relies on a formal structure where authority and enforcement flow from policies down to guidelines.

2

Differentiate mandatory technical requirements from high-level behavioral directives.

Assign the Acceptable Use Policy to behavioral expectations and the Data Encryption Standard to compulsory technical requirements.

Policies establish overarching behavioral scope, whereas standards specify exact technology controls.

3

Separate mandatory baseline configuration states from advisory guidelines.

Assign Container Hardening Baseline to mandatory minimum build settings and Remote Work Security Guideline to discretionary best practices.

Baselines are enforceable build minimums, while guidelines are optional recommendations.

Anahtar Kavram

Security Policy and Governance Hierarchy

Tahmini Süre:2m 0s

Soru 348Soru →

Match each information security governance document type on the left with its correct operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Policy matches the high-level management mandate establishing security goals. Standard matches compulsory rules and technical parameters for uniform implementation. Baseline matches minimum mandatory security configuration standards required for system deployment. Guideline matches discretionary recommendations offering flexible advice.

Each security governance document serves a distinct purpose within an enterprise framework: Policies set executive-level direction and mandates; Standards provide mandatory, uniform technical requirements; Baselines establish the minimum security configuration standard required prior to system deployment; Guidelines supply non-binding, advisory recommendations.

Adım Adım Çözüm

1

Identify the high-level governance document

Policy corresponds to high-level executive direction and broad governance mandates.

Policies represent the top tier of governance and define organizational goals and obligations.

2

Distinguish mandatory technical requirements from deployment floors

Standards correspond to compulsory technical parameters for uniformity, while Baselines define minimum deployment configurations.

Standards enforce operational uniformity, whereas baselines establish the absolute minimum security posture required for operation.

3

Identify discretionary documents

Guideline corresponds to discretionary recommendations and advisory suggestions.

Guidelines are non-mandatory options provided to assist staff in achieving compliance.

Anahtar Kavram

Information Security Governance Document Hierarchy

Soru 349Soru →

In an enterprise information security program, governance documentation is structured into distinct tiers based on enforceability, scope, and technical specificity. Match each governance document type on the left with its corresponding operational characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Security Policy matches executive high-level mandatory directives; Security Standard matches mandatory uniform technical rules; Security Baseline matches mandatory minimum platform configuration states; Security Guideline matches discretionary non-mandatory recommendations.

Security Governance frameworks divide documentation into hierarchical tiers. Policies establish broad management intent and authority. Standards define compulsory technical rules. Baselines enforce the minimum required technical configurations for system operation. Guidelines offer non-binding advisory assistance.

Adım Adım Çözüm

1

Analyze the enforceability tier of each governance document.

Policies, Standards, and Baselines are mandatory, while Guidelines are discretionary.

Governance frameworks explicitly distinguish between mandatory obligations and optional guidance.

2

Evaluate the technical specificity and scope of the mandatory documents.

Policies provide high-level goals, Standards define enterprise-wide uniform technical rules, and Baselines specify platform-level minimum build configurations.

Each document type operates at a different layer within the organizational security hierarchy.

3

Map each document to its matching operational characteristic based on scope and mandate.

Security Policy -> right_1, Security Standard -> right_2, Security Baseline -> right_3, Security Guideline -> right_4.

This alignment correctly reflects standard Security+ governance frameworks.

Anahtar Kavram

Security Governance Hierarchy and Policy Framework Document Types

Tahmini Süre:1m 30s

Soru 350Soru →

Match each Business Impact Analysis (BIA) and Business Continuity Management (BCM) metric on the left with its accurate operational definition on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Recovery Time Objective (RTO) maps to the targeted duration for restoring system operational capacity. Recovery Point Objective (RPO) maps to the maximum acceptable age of unrecovered data. Maximum Tolerable Downtime (MTD) maps to the absolute maximum outage duration before catastrophic damage. Mean Time Between Failures (MTBF) maps to the reliability metric measuring average operational time between breakdowns.

Each continuity metric addresses a distinct aspect of operational risk. RTO establishes how quickly systems must be restored forward in time, RPO specifies acceptable data loss backward in time, MTD represents the fatal threshold of downtime, and MTBF measures system reliability.

Adım Adım Çözüm

1

Analyze time-forward system restoration requirements.

Identify Recovery Time Objective (RTO) as the targeted duration to bring services back online post-outage.

RTO focuses strictly on system availability and recovery timeline moving forward from an incident.

2

Analyze time-backward data loss constraints.

Identify Recovery Point Objective (RPO) as the maximum allowable data loss measured backward from point of failure.

RPO defines backup intervals based on tolerable transactional data loss.

3

Identify the ultimate upper boundary of operational disruption.

Associate Maximum Tolerable Downtime (MTD) with the maximum interruption limit prior to permanent business harm.

MTD establishes the absolute upper boundary; total recovery effort (RTO + Work Recovery Time) must not exceed MTD.

4

Differentiate component availability and reliability metrics.

Associate Mean Time Between Failures (MTBF) with the average operational duration between failures.

MTBF evaluates expected operational lifespan and component reliability rather than incident recovery timelines.

Anahtar Kavram

Business Impact Analysis Metrics (RTO, RPO, MTD, MTBF)

Tahmini Süre:2m 0s

Soru 351Soru →

Match each third-party risk management document or agreement to its primary organizational security purpose.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Service Level Agreement (SLA) matches performance and uptime guarantees; Non-Disclosure Agreement (NDA) matches confidentiality protection; Interconnection Security Agreement (ISA) matches technical network link requirements; Memorandum of Understanding (MOU) matches non-binding intent to collaborate.

Each agreement correctly corresponds to its core security governance function: Service Level Agreements enforce performance and availability standards; Non-Disclosure Agreements maintain data confidentiality; Interconnection Security Agreements define parameters for connecting networks; and Memoranda of Understanding document mutual cooperative intent.

Adım Adım Çözüm

1

Analyze the business and security objective of each governance document.

SLAs focus on operational quality/metrics, NDAs focus on data privacy/confidentiality, ISAs focus on direct system interconnectivity, and MOUs focus on broad mutual intentions.

Third-party risk management relies on distinct document types to govern operational, legal, and technical aspects of partner relationships.

2

Pair each document term with its matching description.

Associate SLA with service metrics, NDA with data protection, ISA with network connection standards, and MOU with shared collaborative intent.

This alignment satisfies standard security management definitions for vendor governance.

Anahtar Kavram

Third-Party Risk Management Agreements and Governance Artifacts

Soru 352Soru →

Match each vulnerability scanning methodology with its most appropriate enterprise operational scenario.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Credentialed Vulnerability Scan pairs with auditing local OS configurations and internal patch levels. Non-Credentialed Vulnerability Scan pairs with mapping exposed network services from an external attacker's perspective. Passive Vulnerability Scan pairs with non-intrusively monitoring live network traffic without sending probes. Web Application Vulnerability Scan pairs with testing dynamic HTTP inputs for application-layer flaws such as XSS and SQL injection.

Each vulnerability assessment method fulfills a distinct operational requirement: Credentialed scans provide deep host visibility with low network traffic; Non-Credentialed scans assess exposure from an unauthenticated perspective; Passive scans capture traffic non-intrusively to protect sensitive devices; and Web Application scans specifically exercise web inputs and application logic for web vulnerabilities.

Adım Adım Çözüm

1

Analyze internal host assessment requirements

Identify that inspecting internal host configurations, software inventories, and local registries accurately requires administrative authentication, matching the Credentialed Vulnerability Scan.

Authenticated access allows direct local checks rather than inferring versions across network ports.

2

Evaluate perimeter and unauthenticated attack surface requirements

Determine that assessing external risk without authentication credentials simulates an outside attacker, matching the Non-Credentialed Vulnerability Scan.

External attackers initially lack credentials, making unauthenticated port scans the standard model for perimeter visibility.

3

Assess sensitive operational technology (OT) monitoring constraints

Recognize that fragile or real-time systems cannot tolerate active probe packets, requiring non-intrusive traffic capture, matching the Passive Vulnerability Scan.

Passive scanning relies on packet listening rather than active probe generation, preventing service disruption.

4

Identify application-layer scanning requirements

Connect dynamic web input testing (such as XSS and SQL injection checks) to specialized Web Application Vulnerability Scans.

Standard network scanners inspect network ports and service headers, whereas web application scanners test HTTP requests, scripts, and database inputs.

Anahtar Kavram

Vulnerability Scanning Methodologies and Operational Scenarios

Tahmini Süre:1m 30s

Soru 353Soru →

An enterprise security architect is formalizing the organization's third-party risk management framework and supply chain security controls. Match each vendor risk oversight scenario to the most appropriate verification mechanism or audit artifact required to validate the control.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Continuous 12-month operational effectiveness pairs with SOC 2 Type II Attestation Report. Firmware binary modification validation pairs with Cryptographically Signed SBOM with Binary Attestation. Standardized onboarding self-assessment pairs with Standardized Information Gathering (SIG) Questionnaire. Continuous sub-tier software dependency tracking pairs with Software Composition Analysis (SCA) paired with SBOM.

Each scenario maps directly to its corresponding vendor oversight artifact based on audit type, timing, and technical mechanism: SOC 2 Type II proves operational effectiveness over time; signed SBOMs with attestations verify firmware build integrity; SIG questionnaires standardize intake self-reporting; and SCA tools automate continuous dependency and vulnerability tracking.

Adım Adım Çözüm

1

Analyze audit report scope and timing requirements.

Operational effectiveness evaluated across a historical period (e.g., 12 months) uniquely characterizes a SOC 2 Type II report, distinguishing it from a Type I report which only evaluates control design at a single point in time.

Third-party risk management requires longitudinal evidence for critical SaaS providers.

2

Evaluate hardware microcode and firmware supply chain integrity mechanisms.

Detecting unauthorized upstream code additions or tampered binaries requires cryptographic verification and component provenance, provided via signed SBOMs and binary integrity attestations.

Static code reviews of third-party compiled binaries without cryptographic signatures cannot guarantee build-pipeline integrity.

3

Differentiate initial intake risk gathering tools from formal third-party audits.

Standardized Information Gathering (SIG) questionnaires serve as pre-contract self-assessment tools to benchmark vendor administrative and technical baseline compliance.

Questionnaires provide broad initial coverage before requesting expensive independent attestations.

4

Select appropriate automated tools for open-source library and software supply chain oversight.

Software Composition Analysis (SCA) coupled with automated SBOM ingestion tracks transitive (nested) third-party library dependencies and alerts security teams to newly published CVEs.

Modern software supply chain security requires continuous scanning of open-source components embedded within vendor and internal software.

Anahtar Kavram

Third-Party Assessment Artifacts and Supply Chain Verification Controls

Soru 354Soru →

An enterprise security team is refining its third-party risk management framework to evaluate complex software supply chains and downstream vendor dependencies. Match each third-party oversight mechanism to its primary risk management or governance objective.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Fourth-Party Risk Management matches evaluating N-tier downstream sub-contractor risks; Software Bill of Materials (SBOM) Attestation matches verifying software component lineage and vulnerabilities; Right-to-Audit Clause matches establishing legal authority for independent facility and security inspections; Vendor Continuous Monitoring matches leveraging automated feeds to track risk posture between formal audits.

Each vendor governance control serves a distinct operational purpose: Fourth-Party Risk Management addresses downstream sub-contractor risks; SBOM Attestation discloses underlying software components to mitigate software supply chain flaws; Right-to-Audit Clauses contractually secure physical and technical verification rights; and Vendor Continuous Monitoring maintains continuous situational awareness between periodic risk assessments.

Adım Adım Çözüm

1

Evaluate Fourth-Party Risk Management objectives

Identified match with downstream N-tier sub-contractor risk evaluation

Fourth parties represent the vendors contracted by direct third-party providers, extending enterprise supply chain exposure.

2

Evaluate Software Bill of Materials (SBOM) Attestation objectives

Identified match with software component lineage verification

SBOMs disclose software components, libraries, and modules, allowing detection of unpatched or vulnerable dependencies.

3

Evaluate Right-to-Audit Clause objectives

Identified match with contractual permission for independent security inspections

Without an explicit audit clause, organizations lack legal standing to perform on-site or technical security reviews of vendor systems.

4

Evaluate Vendor Continuous Monitoring objectives

Identified match with automated threat tracking between audit cycles

Static questionnaires only provide point-in-time snapshots, whereas continuous monitoring provides dynamic risk intelligence.

Anahtar Kavram

Third-Party Risk Management Controls and Supply Chain Oversight Mechanisms

Tahmini Süre:2m 0s

Soru 355Soru →

A security enterprise architect is formalizing Business Impact Analysis (BIA) and Business Continuity Management (BCM) metrics for a multi-region cloud deployment. Match each continuity metric on the left with the operational description on the right that best defines its role in disaster recovery planning.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Maximum Tolerable Downtime pairs with the maximum cumulative outage duration allowed before catastrophic failure. Work Recovery Time pairs with the post-restoration operational phase for data validation and business sign-off. Recovery Service Level pairs with the required percentage of processing capability during contingency mode. Mean Time Between Failures pairs with the average operational uptime between component failures.

Each continuity metric corresponds to a distinct phase or measurement of resilience: MTD defines the maximum overall downtime tolerance; WRT covers post-restoration operational validation; RSL establishes performance capacity expectations during failover; and MTBF measures overall system reliability.

Adım Adım Çözüm

1

Evaluate Maximum Tolerable Downtime (MTD)

Identify that MTD defines the overarching failure limit for business survival.

MTD encompasses both technical system restoration time and operational validation time.

2

Evaluate Work Recovery Time (WRT)

Associate WRT with post-IT restoration activities.

Even after systems are online, data synchronization, integrity checks, and testing must occur before business processes resume.

3

Evaluate Recovery Service Level (RSL)

Connect RSL to degraded operational capability targets.

RSL establishes what capacity (e.g., 80% processing throughput) DR infrastructure must guarantee during failover.

4

Evaluate Mean Time Between Failures (MTBF)

Identify MTBF as a reliability metric measuring uptime stability.

MTBF provides statistical insight into how long components remain operational between breakdowns.

Anahtar Kavram

Business Impact Analysis Metrics and Continuity Planning Boundaries

Soru 356Soru →

Match each regulatory framework or legal mandate to its corresponding compliance and scope requirement.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Gramm-Leach-Bliley Act (GLBA) pairs with financial institution data protection; Federal Information Security Modernization Act (FISMA) pairs with federal agency security standards; Children's Online Privacy Protection Act (COPPA) pairs with regulation of online data collection from children under 13; and California Consumer Privacy Act (CCPA) pairs with state consumer data privacy rights.

Each regulation is paired accurately with its legal mandate: GLBA governs financial institution privacy, FISMA regulates federal IT systems, COPPA protects children under 13 online, and CCPA establishes state-level consumer data privacy rights.

Adım Adım Çözüm

1

Determine the scope of GLBA

GLBA targets financial institutions and consumer nonpublic financial data.

Matches GLBA to financial consumer data requirements.

2

Determine the scope of FISMA

FISMA establishes cybersecurity compliance for US federal agencies and federal contractors.

Matches FISMA to federal agency risk management standards.

3

Identify the age threshold of COPPA

COPPA governs online privacy protection specifically for children under 13 years of age.

Matches COPPA to children's online privacy.

4

Identify the consumer rights granted by CCPA

CCPA establishes consumer privacy and data access rights for California state residents.

Matches CCPA to state resident consumer privacy rights.

Anahtar Kavram

Regulatory Compliance and Legal Requirements Management

Soru 357Soru →

Match each organizational compliance scenario to the specific regulatory mandate or statutory framework that governs its security and privacy controls.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Each enterprise compliance requirement maps directly to its statutory or regulatory framework: restriction of defense software technical data to U.S. persons maps to ITAR; governance of non-bank financial customer data overseen by a Qualified Individual maps to the GLBA Safeguards Rule; European financial sector ICT resilience and third-party risk oversight maps to DORA; and state-level consumer opt-out rights for data selling/sharing maps to CCPA/CPRA.

Each organizational requirement aligns strictly with its governing framework: defense satellite technical data falls under ITAR; non-bank customer record security under the GLBA Safeguards Rule; EU financial sector ICT operational resilience under DORA; and consumer privacy rights allowing opt-out of data selling under CCPA/CPRA.

Adım Adım Çözüm

1

Analyze the technical defense software access control requirement

Identified defense article technical data export restrictions limiting access strictly to U.S. persons

ITAR controls technical data and source code associated with defense technology items under the U.S. Munitions List.

2

Evaluate the non-bank financial institution governance scenario

Matched mandatory Qualified Individual designation and access control enforcement

The FTC GLBA Safeguards Rule establishes explicit security program governance requirements for financial institutions.

3

Evaluate the EU financial sector operational resilience and third-party risk scenario

Identified ICT operational resilience and security testing obligations

DORA enforces binding digital operational resilience standards across European financial entities.

4

Evaluate the consumer privacy data transfer opt-out requirement

Matched statutory opt-out rights for consumer personal data processing and advertising sales

CCPA/CPRA mandates clear mechanisms for consumers to restrict the selling or sharing of personal data.

Anahtar Kavram

Organizational Compliance Mandates and Regulatory Framework Alignment

Soru 358Soru →

An aerospace communications operator is updating its cybersecurity governance framework to ensure clear alignment across strategic leadership, system administrators, and third-party operational contractors. Match each governance document type on the left with its corresponding organizational scope and operational requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Acceptable Use Policy matches the high-level mandatory executive policy governing user behavioral constraints. Technical Security Standard matches the mandatory technical directive specifying explicit controls like cipher suites. Security Baseline matches the mandatory minimum configuration benchmark for system hardening. Security Guideline matches the discretionary document offering best practices and recommendations.

Each governance document type fulfills a distinct level in the governance hierarchy: Policies set high-level executive rules and user boundaries (Acceptable Use Policy); Standards define mandatory technical and cryptographic requirements; Baselines define minimum secure build configurations for systems; and Guidelines provide optional, discretionary recommendations and best practices.

Adım Adım Çözüm

1

Analyze the high-level management layer document (Acceptable Use Policy).

Identify that policies are high-level, mandatory executive statements governing organizational usage and user expectations.

Policies set overarching intent and legal/operational boundaries for personnel.

2

Differentiate between mandatory technical requirements and minimum hardening states.

Map Technical Security Standard to mandatory specific cryptographic/technical requirements, and Security Baseline to minimum system configuration benchmarks.

Standards dictate explicit mandatory implementations, whereas baselines establish the minimum hardening bar.

3

Evaluate discretionary documentation versus mandatory documentation.

Map Security Guideline to the discretionary document containing recommended best practices.

Guidelines are unique within policy governance as they are non-mandatory advice rather than enforced requirements.

Anahtar Kavram

Security Governance Policy Hierarchy and Document Categorization

Soru 359Soru →

An enterprise organization is enhancing its supply chain security and vendor governance program to address risks associated with third-party software, hardware, and service providers. Match each vendor oversight mechanism or contractual control on the left to its corresponding supply chain risk management purpose on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The correct pairings align each third-party risk management mechanism with its supply chain oversight objective: Fourth-Party Subprocessor Flow-Down Clause matches enforcing security requirements across downstream sub-tier service providers; Hardware Origin and Provenance Verification matches preventing counterfeit parts and hardware modifications via chain-of-custody tracking; Software Bill of Materials (SBOM) matches providing visibility into software components and dependencies; and Right-to-Audit Contractual Provision matches granting authority to perform independent security reviews and physical inspections.

Each vendor oversight control targets a distinct vector in supply chain risk management: subprocessor flow-down provisions manage downstream fourth-party risk; hardware provenance verification prevents physical counterfeit and tampering threats; SBOMs provide transparency into application software dependencies; and right-to-audit terms permit formal assessment of vendor compliance.

Adım Adım Çözüm

1

Analyze third-party software inventory and component visibility controls.

Identify that a Software Bill of Materials (SBOM) lists software libraries and dependencies to help track supply chain vulnerabilities.

SBOMs exist to provide comprehensive transparency into nested software dependencies.

2

Evaluate downstream contract management and auditing rights.

Match the Fourth-Party Subprocessor Flow-Down Clause to extending security mandates to downstream subcontractors, and the Right-to-Audit Clause to granting audit rights.

Flow-down clauses manage fourth-party (vendor's vendor) exposure while audit clauses establish legal rights to inspect primary vendors.

3

Examine physical supply chain integrity mechanisms for network devices and components.

Link Hardware Origin and Provenance Verification to anti-counterfeit measures and chain-of-custody tracking.

Hardware provenance focuses on verifying authentic component sourcing and preventing hardware tampering in transit.

Anahtar Kavram

Supply Chain Oversight and Third-Party Governance Controls

Soru 360Soru →

A security analyst is classifying enterprise defense mechanisms according to CompTIA Security+ implementation categories (Technical, Managerial, Operational, Physical) and functional control types (Preventive, Deterrent, Detective, Corrective, Compensating, Directive). Match each security scenario on the left with its primary dual-axis security control classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Web Application Firewall (WAF) filtering maps to Technical / Preventive; Warning notices along the perimeter fence map to Physical / Deterrent; Data restoration from backups maps to Operational / Corrective; Acceptable Use Policy (AUP) onboarding requirement maps to Managerial / Directive.

Each mechanism aligns precisely with standard CompTIA Security+ SY0-701 definitions: WAF operates logically in software to prevent attacks (Technical/Preventive); perimeter signs are tangible physical measures designed to deter trespassers (Physical/Deterrent); restoring backups requires personnel operational procedures to fix post-attack damage (Operational/Corrective); and AUP requirements represent managerial policy governance that directs compliant user behavior (Managerial/Directive).

Adım Adım Çözüm

1

Analyze the web application firewall (WAF) deployment.

Identified as a logic/software control (Technical) that blocks attack vectors before impact (Preventive).

Technical controls utilize hardware/software mechanisms, while preventive controls proactively halt threat execution.

2

Analyze the warning signage along the perimeter fence.

Identified as a tangible real-world control (Physical) designed to discourage intruders (Deterrent).

Physical controls exist in the physical environment, while deterrent controls aim to dissuade potential attackers through psychological disincentives.

3

Analyze the data restoration process from backups post-ransomware.

Identified as a human-driven operational procedure (Operational) that restores system state after an incident (Corrective).

Operational controls depend on day-to-day human execution and workflows, while corrective controls mitigate damage and restore operations.

4

Analyze the onboarding Acceptable Use Policy (AUP) requirement.

Identified as administrative governance (Managerial) enforcing mandatory behavior (Directive).

Managerial controls center on security governance, risk assessment, and policies, while directive controls mandate specific conduct.

Anahtar Kavram

CompTIA Security+ dual-axis classification framework categorizes security controls by implementation method (Technical, Managerial, Operational, Physical) and functional purpose (Preventive, Deterrent, Detective, Corrective, Compensating, Directive).

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram